CVE-2015-7318: Input Validation
A vulnerability was found allowing users who have access to write cookie values were able to inject headers into the response. Versions affected are all versions Plone 3.
Upstream hotfix:
https://plone.org/security/20150910/
CVE request:
http://seclists.org/oss-sec/2015/q3/589
Other sources
Plone 3.3.0 through 3.3.6 allows remote attackers to inject headers into HTTP responses.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2015-7318?
CVE-2015-7318 is considered a moderate severity vulnerability due to its potential for header injection and impact on security.
How do I fix CVE-2015-7318?
To fix CVE-2015-7318, upgrade to Plone version 4.0a1 or later.
What versions of Plone are affected by CVE-2015-7318?
All versions of Plone from 3.3 to 3.3.6 are affected by CVE-2015-7318.
Can CVE-2015-7318 lead to any security risks?
Yes, CVE-2015-7318 can potentially lead to unauthorized header injection that may compromise user sessions.
Is there a workaround for CVE-2015-7318?
There is no official workaround for CVE-2015-7318; the recommended action is to upgrade to a secure version.